Skip to content
This repository has been archived by the owner on Feb 4, 2022. It is now read-only.

HttpUrl path is not correctly encoded #56

Closed
johanjanssens opened this issue Apr 25, 2016 · 2 comments · Fixed by #57
Closed

HttpUrl path is not correctly encoded #56

johanjanssens opened this issue Apr 25, 2016 · 2 comments · Fixed by #57
Assignees
@johanjanssens
Labels
bug
Milestone
v3.0.0

Comments

@johanjanssens
Copy link
Member

johanjanssens commented Apr 25, 2016 •
edited
Loading

HttpUrl implements a custom path encoding mechanism which does not properly escape the path. Refactor HttpUrl and harden it using rawurlencode() instead of a urlencode() or custom path encoding.

Note: since PHP5.3 rawurlencode comforms to rfc3986. (more info)
@johanjanssens johanjanssens added this to the 3.0.0-beta.2 milestone Apr 25, 2016
@johanjanssens johanjanssens changed the title HttpUrl is path is correctly encoded HttpUrl path is correctly encoded Apr 25, 2016
johanjanssens added a commit that referenced this issue Apr 25, 2016
@johanjanssens
Issue #56: Fix and harden url encoding
43b3508 
- Replace urldedod() with rawurldecode()
- Replace urlencode() with rawurlencode()
- Do not use custom encoding for url path
@johanjanssens johanjanssens mentioned this issue Apr 25, 2016
Merged
johanjanssens added a commit that referenced this issue Apr 25, 2016
@johanjanssens
Issue #56: Do not set escaper for mustache
5ee00be 
Mustache default escaper already uses htmlspecialchars().
johanjanssens added a commit that referenced this issue Apr 25, 2016
@johanjanssens
Issue #56: Docblocks
08c35d9
johanjanssens added a commit that referenced this issue Apr 28, 2016
@johanjanssens
Issue #56: Only strip leading slashes
20f6c23
johanjanssens added a commit that referenced this issue May 2, 2016
@johanjanssens
Issue #56: Fix docblocks
2980301
@johanjanssens johanjanssens changed the title HttpUrl path is correctly encoded HttpUrl path is not correctly encoded May 2, 2016
@johanjanssens
Copy link
Member Author

@ercanozkaya This is merged. I would consider merging this to Joomlatools Framework too as this can be considered a low prio security issue.

johanjanssens added a commit that referenced this issue May 2, 2016
@johanjanssens
Issue #56: Fix docblocks
ae7843d
johanjanssens added a commit that referenced this issue May 20, 2016
@johanjanssens
Issue #56: Recursively decode the query array
7a9adff
@johanjanssens
Copy link
Member Author

Note: Needs to be merged to Joomlatools Framework 3.0

@johanjanssens johanjanssens self-assigned this May 24, 2016
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@johanjanssens johanjanssens

Labels
bug
Projects
None yet
Milestone
v3.0.0
Development

Successfully merging a pull request may close this issue.

HttpUrl path is not correctly encoded timble/kodekit
1 participant
@johanjanssens